Skip to content

Commit 90e21e3

Browse files
derhallyderhally
committed
Add support for data fusion
Add support for granting the data fusion service agent access to the subnet in the shared vpc Allow specifying the role needed on the subnet for each service agent.
1 parent 12c63ea commit 90e21e3

File tree

1 file changed

+47
-17
lines changed

1 file changed

+47
-17
lines changed

‎modules/shared_vpc_access/main.tf

+47-17
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,42 @@ data "google_project" "service_project" {
2222
locals {
2323
service_project_number = var.lookup_project_numbers ? data.google_project.service_project[0].number : var.service_project_number
2424
apis = {
25-
"container.googleapis.com" : format("service-%s@container-engine-robot.iam.gserviceaccount.com", local.service_project_number),
26-
"dataproc.googleapis.com" : format("service-%s@dataproc-accounts.iam.gserviceaccount.com", local.service_project_number),
27-
"dataflow.googleapis.com" : format("service-%s@dataflow-service-producer-prod.iam.gserviceaccount.com", local.service_project_number),
28-
"composer.googleapis.com" : format("service-%s@cloudcomposer-accounts.iam.gserviceaccount.com", local.service_project_number)
29-
"vpcaccess.googleapis.com" : format("service-%s@gcp-sa-vpcaccess.iam.gserviceaccount.com", local.service_project_number)
30-
"datastream.googleapis.com" : format("service-%s@gcp-sa-datastream.iam.gserviceaccount.com", local.service_project_number)
31-
"notebooks.googleapis.com" : format("service-%s@gcp-sa-notebooks.iam.gserviceaccount.com", local.service_project_number)
32-
"networkconnectivity.googleapis.com" : format("service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com", local.service_project_number)
25+
"container.googleapis.com" : {
26+
service_account = format("service-%s@container-engine-robot.iam.gserviceaccount.com", local.service_project_number)
27+
role = "roles/compute.networkUser"
28+
}
29+
"dataproc.googleapis.com" : {
30+
service_account = format("service-%s@dataproc-accounts.iam.gserviceaccount.com", local.service_project_number)
31+
role = "roles/compute.networkUser"
32+
},
33+
"dataflow.googleapis.com" : {
34+
service_account = format("service-%s@dataflow-service-producer-prod.iam.gserviceaccount.com", local.service_project_number)
35+
role = "roles/compute.networkUser"
36+
},
37+
"datafusion.googleapis.com" : {
38+
service_account = format("service-%s@gcp-sa-datafusion.iam.gserviceaccount.com", local.service_project_number)
39+
role = "roles/compute.networkViewer"
40+
},
41+
"composer.googleapis.com" : {
42+
service_account = format("service-%s@cloudcomposer-accounts.iam.gserviceaccount.com", local.service_project_number)
43+
role = "roles/compute.networkUser"
44+
}
45+
"vpcaccess.googleapis.com" : {
46+
service_account = format("service-%s@gcp-sa-vpcaccess.iam.gserviceaccount.com", local.service_project_number)
47+
role = "roles/compute.networkUser"
48+
}
49+
"datastream.googleapis.com" : {
50+
service_account = format("service-%s@gcp-sa-datastream.iam.gserviceaccount.com", local.service_project_number)
51+
role = "roles/compute.networkUser"
52+
}
53+
"notebooks.googleapis.com" : {
54+
service_account = format("service-%s@gcp-sa-notebooks.iam.gserviceaccount.com", local.service_project_number)
55+
role = "roles/compute.networkUser"
56+
}
57+
"networkconnectivity.googleapis.com" : {
58+
service_account = format("service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com", local.service_project_number)
59+
role = "roles/compute.networkUser"
60+
}
3361
}
3462
gke_shared_vpc_enabled = contains(var.active_apis, "container.googleapis.com")
3563
composer_shared_vpc_enabled = contains(var.active_apis, "composer.googleapis.com")
@@ -44,7 +72,8 @@ locals {
4472
/******************************************
4573
if "container.googleapis.com" compute.networkUser role granted to GKE service account for GKE on shared VPC subnets
4674
if "dataproc.googleapis.com" compute.networkUser role granted to dataproc service account for dataproc on shared VPC subnets
47-
if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC subnets
75+
if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC subnets
76+
if "datafusion.googleapis.com" compute.networkViewer role granted to datafusion service account for Data Fusion on shared VPC subnets
4877
if "composer.googleapis.com" compute.networkUser role granted to composer service account for Composer on shared VPC subnets
4978
if "notebooks.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project
5079
if "networkconnectivity.googleapis.com" compute.networkUser role granted to notebooks service account for Network Connectivity on shared VPC Project
@@ -65,13 +94,13 @@ resource "google_compute_subnetwork_iam_member" "service_shared_vpc_subnet_users
6594
"subnetworks",
6695
) + 1,
6796
)
68-
role = "roles/compute.networkUser"
97+
role = local.apis[split(",", local.subnetwork_api[count.index])[0]].role
6998
region = element(
7099
split("/", split(",", local.subnetwork_api[count.index])[1]),
71100
index(split("/", split(",", local.subnetwork_api[count.index])[1]), "regions") + 1,
72101
)
73102
project = var.host_project_id
74-
member = format("serviceAccount:%s", local.apis[split(",", local.subnetwork_api[count.index])[0]])
103+
member = format("serviceAccount:%s", local.apis[split(",", local.subnetwork_api[count.index])[0]].service_account)
75104
}
76105

77106
/******************************************
@@ -101,15 +130,16 @@ resource "google_compute_subnetwork_iam_member" "cloudservices_shared_vpc_subnet
101130
if "container.googleapis.com" compute.networkUser role granted to GKE service account for GKE on shared VPC Project if no subnets defined
102131
if "dataproc.googleapis.com" compute.networkUser role granted to dataproc service account for Dataproc on shared VPC Project if no subnets defined
103132
if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC Project if no subnets defined
133+
if "datafusion.googleapis.com" compute.networkViewer role granted to data fusion service account for Data Fusion on shared VPC Project if no subnets defined
104134
if "composer.googleapis.com" compute.networkUser role granted to composer service account for Composer on shared VPC Project if no subnets defined
105135
if "notebooks.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project if no subnets defined
106136
if "networkconnectivity.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project if no subnets defined
107137
*****************************************/
108138
resource "google_project_iam_member" "service_shared_vpc_user" {
109139
for_each = (length(var.shared_vpc_subnets) == 0) && var.enable_shared_vpc_service_project && var.grant_network_role ? toset(local.active_apis) : []
110140
project = var.host_project_id
111-
role = "roles/compute.networkUser"
112-
member = format("serviceAccount:%s", local.apis[each.value])
141+
role = local.apis[each.value].role
142+
member = format("serviceAccount:%s", local.apis[each.value].service_account)
113143
}
114144

115145
/******************************************
@@ -120,7 +150,7 @@ resource "google_project_iam_member" "composer_host_agent" {
120150
count = local.composer_shared_vpc_enabled && var.enable_shared_vpc_service_project && var.grant_network_role ? 1 : 0
121151
project = var.host_project_id
122152
role = "roles/composer.sharedVpcAgent"
123-
member = format("serviceAccount:%s", local.apis["composer.googleapis.com"])
153+
member = format("serviceAccount:%s", local.apis["composer.googleapis.com"].service_account)
124154
}
125155

126156
/******************************************
@@ -131,7 +161,7 @@ resource "google_project_iam_member" "gke_host_agent" {
131161
count = local.gke_shared_vpc_enabled && var.enable_shared_vpc_service_project && var.grant_network_role ? 1 : 0
132162
project = var.host_project_id
133163
role = "roles/container.hostServiceAgentUser"
134-
member = format("serviceAccount:%s", local.apis["container.googleapis.com"])
164+
member = format("serviceAccount:%s", local.apis["container.googleapis.com"].service_account)
135165
}
136166

137167
/******************************************
@@ -143,7 +173,7 @@ resource "google_project_iam_member" "gke_security_admin" {
143173
count = local.gke_shared_vpc_enabled && var.enable_shared_vpc_service_project && var.grant_services_security_admin_role ? 1 : 0
144174
project = var.host_project_id
145175
role = "roles/compute.securityAdmin"
146-
member = format("serviceAccount:%s", local.apis["container.googleapis.com"])
176+
member = format("serviceAccount:%s", local.apis["container.googleapis.com"].service_account)
147177
}
148178

149179
/******************************************
@@ -155,5 +185,5 @@ resource "google_project_iam_member" "datastream_network_admin" {
155185
count = local.datastream_shared_vpc_enabled && var.enable_shared_vpc_service_project && var.grant_services_network_admin_role ? 1 : 0
156186
project = var.host_project_id
157187
role = "roles/compute.networkAdmin"
158-
member = format("serviceAccount:%s", local.apis["datastream.googleapis.com"])
188+
member = format("serviceAccount:%s", local.apis["datastream.googleapis.com"].service_account)
159189
}

0 commit comments

Comments
 (0)